CVE-2026-53946

Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user...

CVE-2026-53128

creationtimestamp| type| source ---|---|--- 2026-06-24 18:45:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2l6ivx4f2c 2026-07-06 06:48:54+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706...

CVE-2026-53125

creationtimestamp| type| source ---|---|--- 2026-06-24 18:40:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2kvkeajd2o 2026-07-23 21:23:35+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrdrj7lafh2x...

EUVD-2026-38905

In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix deadlock in hidpostreset You can build a USB device that includes a HID component and a storage or UAS component. The components can be reset only together. That means that hidprereset and hidpostreset are in the...

CVE-2026-53115

creationtimestamp| type| source ---|---|--- 2026-06-24 18:26:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2k3sr5yk2o...

CVE-2026-53114

creationtimestamp| type| source ---|---|--- 2026-06-24 18:21:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2jsgpacw2z...

CVE-2026-12100

creationtimestamp| type| source ---|---|--- 2026-06-24 18:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp2jjciwlm2v...

CVE-2026-53120

creationtimestamp| type| source ---|---|--- 2026-06-24 18:14:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2jgtpcv72o...

CVE-2026-53124

creationtimestamp| type| source ---|---|--- 2026-06-24 18:12:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2jdhyq422q...

CVE-2026-53113

creationtimestamp| type| source ---|---|--- 2026-06-24 18:09:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2j5bz2n227...

CVE-2026-53946

Ghost (Node.js CMS) is affected in versions 6.19.4–6.21.1. During post re-render, Ghost fetches image dimensions by issuing an outbound HTTP request to the URL stored on an image card, without restricting allowed hosts. An authenticated staff user who can create or edit posts could point an image...

CVE-2026-53946 Ghost: Mobiledoc image-size fetch SSRF

Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user...

CVE-2026-56121

creationtimestamp| type| source ---|---|--- 2026-06-24 17:02:50+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3mp2fgb4nax2n 2026-06-24 18:05:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2ivxcg222z 2026-07-13 22:00:16+00:00| seen|...

CVE-2026-53037

CVE-2026-53037 affects the Linux kernel with a deadlock in HID reset handling when a USB HID device is paired with a storage/UAS component. The issue arises because hid_pre_reset() and hid_post_reset() may perform memory allocations that touch IO, risking deadlock, so the patch switches allocatio...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: rocker: A memory leak was fixed in rockerworldportpostfini. In rockerworldportpreinit, rockerport-wpriv is allocated using kzallocwops-portprivsize, GFPKERNEL. However, in rockerworldportpostfini, the memory is only freed when th...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validates wqesize before using it in ibuverbspostsend. The ibuverbspostsend function uses cmd.wqesize from the user space without any validation before passing it to kmalloc. The allocated buffer is then used as stru...

CVE-2026-13163

creationtimestamp| type| source ---|---|--- 2026-06-24 14:26:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp24pjpeuc2s...

CVE-2026-56368

creationtimestamp| type| source ---|---|--- 2026-06-24 14:21:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp24gl6h7e2p...

CVE-2026-56370

creationtimestamp| type| source ---|---|--- 2026-06-24 14:16:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp245mozpl2v...

MAL-2026-6392 Malicious code in cccmyssr3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a15e77975be346fa9b834e50124784a6774b5385e47072ae80911f5eda92cabf On npm install, this package automatically runs postinstall.js, which executes curl -X POST with a body containing the installer's hostname $hostname...